AI moves fast. Stay in the know.

A recent Cybersecurity Dive report highlights growing concerns among security leaders about organizations' ability to govern AI agents and unauthorized AI use. Based on an Okta survey of 306 CISOs and cybersecurity executives across six countries, the findings show substantial gaps in AI visibility, access control, and alignment between security teams and business leadership.

The report suggests that as employees and teams rapidly adopt AI tools and agents, many organizations lack a complete understanding of what AI is operating within their environments, what corporate resources those systems can access, and whether appropriate governance controls are in place.

Source: Cybersecurity Dive

What to know:

• 81% of CISOs are concerned that their organizations' AI systems are not properly governed.
• Only 47% of surveyed companies said they knew about all AI agents operating on their networks.
• Just 46% reported controlling AI agents' access to corporate data, indicating significant gaps in data access governance.
• 68% of CISOs reported at least some unauthorized AI use, highlighting the prevalence of Shadow AI within enterprise environments.
• Around one-fifth of organizations allow AI agents to access network resources using shared credentials or highly privileged agent-specific accounts, creating weak boundaries around what agents can access or do.
• Only 25% of respondents said their organizations manage AI agents through a dedicated access framework.
• Fewer than one-third of CISOs said they were fully aligned with their CEOs and boards on acceptable levels of AI risk.
• In the U.S., only 12% of CISOs reported being fully aligned with leadership on AI risk tolerance.
• Fewer than half of CISOs believe their boards view AI security as a business enabler rather than a barrier to growth.
• 57% of security leaders globally said they were extremely or very concerned about AI-driven breaches.
• Concern was significantly higher in the U.S., where 84% of security leaders reported being extremely or very worried about AI-driven breaches.
• AI-enhanced phishing, malicious AI agents, and deepfakes capable of bypassing authentication were among the leading concerns identified by security executives.

Why it matters:

Organizations may be adopting AI faster than their security and governance frameworks can keep pace. When companies cannot identify all AI agents operating within their environments or control what corporate data those systems can access, unauthorized AI use can create significant visibility, data security, and access-control gaps.

The findings reinforce the need for organizations to continuously discover and monitor AI usage, identify unauthorized tools and agents, control access to sensitive information, and establish clear governance policies around AI activity. For mid-sized businesses expanding GenAI adoption, AI security needs to extend beyond approving individual tools to understanding what AI is actually being used, what data it can access, and whether its activity remains within organizational policy.

A recent industry analysis highlighted how employees often turn to unauthorized AI tools when approved options are too limited, unsuitable, or difficult to access. The use of consumer-grade AI applications can expose confidential workplace information through data leakage, secondary use in model training, or other forms of data exfiltration.

The report argues that shadow AI is often a symptom of weak workplace policies, inadequate tooling, and insufficient technical safeguards rather than deliberate employee misconduct.

Source: TechRadar

What to know:

• Shadow AI is a widespread issue affecting businesses across different sizes, industries, and regions.
• Employees may use unauthorized AI tools when approved workplace applications do not meet their practical requirements.
• Consumer-grade AI applications can put confidential and sensitive workplace data at risk.
• Potential risks include direct data leakage and the secondary use of submitted information for model training.
• Restrictive policies alone may encourage employees to find alternative tools outside approved business environments.
• AI policies often fail when they are too technical, difficult to understand, or stored in locations employees rarely access.
• The article recommends placing AI guidance and policy controls directly within the tools and workflows employees already use.
• Training alone may not be sufficient to prevent unsafe AI usage or improve employee AI literacy.
• Organizations should understand why employees prefer particular AI tools before designing governance policies and approved-tool strategies.
• Technical controls are needed to restrict the riskiest behavior while allowing employees to use AI productively.
• Secure testing environments and synthetic data can help employees experiment with AI without exposing real business information.

Why it matters:

Organizations may have limited visibility into which AI tools employees use, what information they submit, and whether those tools meet company security requirements.

Without continuous AI usage monitoring and enforceable controls, sensitive business data may be entered into personal accounts or unauthorized applications without the security team’s knowledge.

The findings support a governance approach that combines shadow AI discovery, clear policies, suitable approved tools, contextual access controls, and real-time data protection rather than relying only on bans or employee training.